SNMP OID Classifiers incorrectly updated by system, possibly Sync from CDS UI Action

[Bob Mullineaux]

Recently something on our Prod instance created 304 new SNMP OID Classifiers by the system user.  Some of those classifiers are incorrect which resulted in Models being overwritten on some of the Cisco Switches.  We are not certain what created these new SNMP OID Classifiers since the creation date does not coincide with system upgrades or Discovery Pattern/CMDB Model updates. 

Does any one know of anything in the system that automatically would updated the SNMP OID Classifiers and what system logs exist that would identify the system trigger.   I have check the System Logs and Update Logs and see nothing. 

One concern I have, is there are new buttons appearing on SNMP OID Classification screen (see attached) that say "Sync from CDS" and "Sync Candidates" that appear to download and create or update system OIDs.   Testing in the Dev instance, clicking those buttons result in no information or warning message, but indeed appears to trigger a download of SNMP OID updates.   I cannot locate any documentation on those buttons and indeed this is an undesirable feature since it is not uncommon to customize SNMP OIDs and not desirable to have them overwritten. 

Running on the Washington DC release, Discovery Admin workspace 1.3.3, Discovery Patterns 1.18.1, CMDB Class Models, 1.63.0

[Niklas Peterson]

Hi,

Looks like you are using the ITOM Content Service . 

https://store.servicenow.com/sn_appstore_store.do#!/store/application/37b36c03eb2ad1101a443e82b85228...

Regards,
Niklas

[Bob Mullineaux]

Hi Niklas, 

We are not opt'd into ITOM CDS and as far as I am aware, no one clicked the "sync to cds".   We have installed Discovery Admin Workspace in October and certainly there is value in using the content delivered..."if the content delivered is correct" which in our case effectively resulted in the hardware models being changed on several hundred Cisco Switches.    ServiceNow Support has verified the OID provided is incorrect which is easy enough to delete...but the impact of what happen was somewhat catastrophic when you consider the impact of Hardware Asset Life-Cycle management.    ServiceNow Support has not been able to tell me at this point what triggered the download of this SNMP OID Content.  I tested "Sync to CDS" in our Dev environment and do not like how there is no notification of what is going to happen and no message at all that a function was triggered.   Thank you for your reply since it did point me in the direction of the documentation that I could not previously find.   

[Bob Mullineaux]

Hello,

An update and additional info for anyone needing to know...

When you install Discovery Admin Workspace, ITOM Content Service also gets installed with it. Please refer to the below document for opting in.
https://www.servicenow.com/docs/bundle/vancouver-it-operations-management/page/product/discovery/tas...

What I found is opt-in is not necessary and there is a daily scheduled job (Download Discovery Smart Content SNMP OIDs) that runs and downloads SNMP OIDs from the ITOM CDS.   To execute the Download manually, you would click the Sync from CDS button on the SNMP OID Classification List View. 

Be advised that the content that is being downloaded appears not to be properly curated (something I hope ServiceNow improves).   In my case, the Cisco OID 1.3.6.1.4.1.2494 cause the correct Discovered models to be overwritten.  My solution was to make this OID Inactive, which reverted the correct Models back during the next Discover cycles.   (my preference would be for the Discovered Model to take precedence over the the SNMP OID configuration...especially since this download is problematic as you can see in the screen shot below).